diff --git a/source3/smbd/smb2_getinfo.c b/source3/smbd/smb2_getinfo.c index bbc838d..96226d6 100644 --- a/source3/smbd/smb2_getinfo.c +++ b/source3/smbd/smb2_getinfo.c @@ -105,8 +105,17 @@ NTSTATUS smbd_smb2_request_process_getinfo(struct smbd_smb2_request *req) return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER); } - status = smbd_smb2_request_verify_creditcharge(req, - MAX(in_input_buffer.length,in_output_buffer_length)); + /* + * According to [MS-SMB2] 3.2.4.1.5 Sending Multi-Credit Requests: + * + * > For all other requests, the client MUST set CreditCharge to 1, even + * > if the payload size of a request or the anticipated response is + * > greater than 65536 + * + * we can only check for 1 credit and ignore in_output_buffer_length + * here. + */ + status = smbd_smb2_request_verify_creditcharge(req, 65536); if (!NT_STATUS_IS_OK(status)) { return smbd_smb2_request_error(req, status); } diff --git a/source3/smbd/smb2_notify.c b/source3/smbd/smb2_notify.c index c35acc5..18fdde7 100644 --- a/source3/smbd/smb2_notify.c +++ b/source3/smbd/smb2_notify.c @@ -78,8 +78,17 @@ NTSTATUS smbd_smb2_request_process_notify(struct smbd_smb2_request *req) return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER); } - status = smbd_smb2_request_verify_creditcharge(req, - in_output_buffer_length); + /* + * According to [MS-SMB2] 3.2.4.1.5 Sending Multi-Credit Requests: + * + * > For all other requests, the client MUST set CreditCharge to 1, even + * > if the payload size of a request or the anticipated response is + * > greater than 65536 + * + * we can only check for 1 credit and ignore in_output_buffer_length + * here. + */ + status = smbd_smb2_request_verify_creditcharge(req, 65536); if (!NT_STATUS_IS_OK(status)) { return smbd_smb2_request_error(req, status); diff --git a/source3/smbd/smb2_setinfo.c b/source3/smbd/smb2_setinfo.c index cda8abc..0f8148d 100644 --- a/source3/smbd/smb2_setinfo.c +++ b/source3/smbd/smb2_setinfo.c @@ -89,8 +89,17 @@ NTSTATUS smbd_smb2_request_process_setinfo(struct smbd_smb2_request *req) return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER); } - status = smbd_smb2_request_verify_creditcharge(req, - in_input_buffer.length); + /* + * According to [MS-SMB2] 3.2.4.1.5 Sending Multi-Credit Requests: + * + * > For all other requests, the client MUST set CreditCharge to 1, even + * > if the payload size of a request or the anticipated response is + * > greater than 65536 + * + * we can only check for 1 credit and ignore in_output_buffer_length + * here. + */ + status = smbd_smb2_request_verify_creditcharge(req, 65536); if (!NT_STATUS_IS_OK(status)) { return smbd_smb2_request_error(req, status); }